Your staff are already using AI tools. Someone is pasting meeting notes into a chatbot to get a summary. Someone else installed a browser extension that "writes better emails". A manager is asking an assistant to rank job applicants. None of this is necessarily bad, but without rules you have no idea which company data has gone where, and nobody knows what they're allowed to do.
An AI acceptable use policy (AUP) fixes that. It doesn't need to be long. The best ones fit on a page or two, use plain language, and answer the three questions employees actually have: Which tools can I use? What can I put into them? What am I still responsible for?
This guide walks through how to write one for a small or mid-sized organization, with examples and a short sample outline you can adapt.
Why a short policy beats a perfect one
Small businesses tend to stall on AI policy because it feels like it needs a lawyer, a committee and a risk framework. Those things help later. Right now, the biggest risks are simple and common:
- Data leakage: confidential or personal data pasted into a consumer tool whose terms allow the provider to keep or train on it
- Unchecked output: AI-drafted content sent to customers with wrong facts, made-up references or someone else's copyrighted text
- Automated decisions about people: screening, scoring or disciplining staff or applicants with no human review
- Shadow tools: extensions, plugins and "AI features" quietly switched on inside apps you already pay for
A clear one-page policy published this month addresses all four. You can build the fuller program (tool intake reviews, an AI inventory, vendor contract terms) over the following quarter.
Step 1: Decide who owns it
Pick one accountable owner. In a small business that's usually the IT lead, operations manager or whoever owns security. Name a second approver from HR or leadership. Write both into the policy header along with an effective date and a review date (at least annually; AI tools change fast, so six months is better).
Step 2: Inventory what people already use
Before writing rules, find out what's happening. A 10-minute anonymous survey works well:
- Which AI tools have you used for work in the last month?
- Are you signed in with a work account, a personal account or no account?
- What do you use them for (drafting, summarizing, coding, research, images, meetings)?
- Have you ever pasted customer, employee or financial information into one?
- What would you like to use AI for but haven't, because you weren't sure it was allowed?
Pair it with a quick technical check: browser extensions on managed devices, OAuth apps connected to your email and file storage, and AI features enabled in your existing SaaS admin consoles. The answers will tell you which tools to approve, which to block and where the real data risk is.
Step 3: Define approved tools in tiers
A tiered model is easier for staff than a long allow/deny list:
| Tier | What it means | Example |
|---|---|---|
| Approved for internal data | Company-licensed, signed in with a work account, with contract terms that say your data isn't used to train models | The assistant built into your company's office suite, if your plan's terms cover this |
| Approved for public data only | Fine for brainstorming or rewriting public information. No company or personal data. | A free chatbot used to draft a generic job ad |
| Not approved | Blocked or forbidden for company work | Unvetted browser extensions, apps that want access to your whole mailbox |
Keep the actual list on a separate page (an intranet page or shared doc) and link it from the policy, so you can update tools without re-approving the policy.
Step 4: Write data rules people can apply in five seconds
This is the most important section. Tie it to the data categories you already use, or define simple ones:
| Data type | Approved for internal data | Public-only tools |
|---|---|---|
| Public information (website copy, published docs) | Yes | Yes |
| Internal (non-sensitive notes, process docs) | Yes | No |
| Confidential (financials, contracts, strategy, source code) | Only if the tool is explicitly approved for it | No |
| Personal data (customer or employee details) | Only if the tool is explicitly approved for it | No |
| Credentials (passwords, API keys, tokens) | Never | Never |
Add a tie-breaker: "When unsure, treat it as confidential and ask."
Worked examples help more than definitions. Include three or four:
- ✅ "Summarize these anonymized meeting notes" in the company assistant
- ✅ "Suggest five subject lines for this public product announcement" in any approved tool
- ❌ "Here's our customer export, find the churn risks" in a personal chatbot account
- ❌ "Debug this script" when the script contains a live API key
Step 5: Make humans accountable for output
AI output is a draft, not a source. The policy should say plainly:
- You are responsible for anything you send, publish or act on, however it was produced.
- Check facts, numbers, names and references before use. AI tools can confidently invent all four.
- Check for bias, security problems (especially in generated code) and copied material.
- AI must not make final decisions about people: hiring, performance, pay, discipline, credit or access. A person reviews and documents the decision.
Step 6: Be clear on transparency
Decide when people must disclose AI use. A practical rule: disclose when content is substantially AI-generated and it's customer-facing, published, legal, or the customer or contract requires it. Internal drafts usually don't need a label. Never present AI output as independently verified fact without checking it.
Step 7: List what's prohibited
Keep this short and concrete:
- Creating deceptive, harassing, discriminatory or illegal content
- Impersonating real people (voice, image or writing) without consent
- Generating malware or trying to get around security controls
- Recording or transcribing colleagues or customers without the notice and consent the law and your policies require
- Using personal AI accounts for company work
- Connecting AI tools or extensions to company email, files or systems without IT approval
Step 8: Say how to report problems
Mistakes will happen. Make it safe to report them quickly: "If you think you've put the wrong data into an AI tool, or you see unapproved AI use, tell [contact] right away. Reporting in good faith will not be held against you." That sentence does more for security than any monitoring tool.
Step 9: Exceptions, enforcement and acknowledgment
- Exceptions: written approval from a named role, recorded with an expiry date.
- Enforcement: point to your existing disciplinary process rather than inventing a new one.
- Acknowledgment: a signature line or an e-sign step at the bottom. You'll want a record that people read it.
Sample AI acceptable use policy outline
Here is a short outline you can turn into a one- or two-page policy. Replace the bracketed fields.
- Purpose and scope. Covers generative AI tools (chatbots, writing, coding, image and meeting assistants, and AI features inside existing apps). Applies to all employees, contractors and temporary staff on any device when company work or data is involved.
- Approved tools. Use only tools on the Approved AI Tools list at [link], signed in with your company account. Request new tools, extensions or AI features from [contact] before use.
- Data rules. The data table above, plus "never enter credentials" and "when unsure, treat as confidential."
- Human review and accountability. You own the output. Verify before use. No final decisions about people without documented human review.
- Transparency. Disclose substantial AI use in customer-facing, published or legal material, or where required.
- Prohibited uses. The list from Step 7.
- Security and incident reporting. Report data mistakes and unapproved use to [contact]. Good-faith reports are protected.
- Exceptions and enforcement. Written exceptions from [role]. Violations handled under existing policies.
- Ownership and review. Owner [name/role], approver [name/role], effective [date], next review [date].
- Acknowledgment. Name, signature, date.
Rolling it out in two weeks
Week 1
- [ ] Run the usage survey and the technical check
- [ ] Draft the policy using the outline above
- [ ] Publish the Approved AI Tools list (start with two or three tools)
- [ ] Have HR and, ideally, legal counsel review it
Week 2
- [ ] Leadership approves and announces it, ideally in a short all-hands slot rather than only by email
- [ ] Collect acknowledgments
- [ ] Turn off or restrict AI features and extensions that aren't on the approved list, using your admin consoles
- [ ] Put a review date in the calendar
Afterwards: add a simple intake form for new tool requests, keep a list of the AI tools and features in use, and check that the contracts for your approved tools cover data use, retention and training the way you expect.
Common mistakes to avoid
- Banning everything. People will use personal accounts anyway, and you lose visibility. Approve something useful.
- Writing for lawyers. If staff can't apply it in five seconds, they won't.
- Forgetting built-in AI. The biggest exposure is often an AI feature switched on by default in a tool you already use.
- Publishing and walking away. Tools, terms and features change quarterly. Review the list at least that often.
This is general guidance, not legal advice. Have qualified counsel review your final policy, especially if you handle regulated data or operate in several jurisdictions.
Resources: Free 1-page AI acceptable use policy template · Full kit with a tool intake questionnaire, vendor AI clause checklist and NIST AI RMF workbook: AI Acceptable Use Policy Template + AI Governance Kit ($39; code LAUNCH30 takes 30% off paid kits through Oct 31, 2026). I make these templates.
Drafted with AI assistance and reviewed for accuracy.
Not affiliated with Microsoft or Google.
Top comments (1)
The sample outline is helpful—the tricky part is making it enforceable without killing productivity. I'd add a section on what happens when employees use personal AI tools for work.